You can compound the str_replace function calls to replace multiple characters like this:
str_replace("&", "_", str_replace(" ", "_", $_POST["page"]))
This would replace any "&" characters with an underscore and replace any spaces with an underscore. There might be some better ways to do this in php but this should do the trick for you. Here is a link to the functions page on the php site for more info:
php.net/str_replace